CVE-2024-20419: Cisco Smart Software Manager On-Prem Password Change Vulnerability

On July 17, 2024, Cisco published an advisory for a critical vulnerability in Cisco’s Smart Software Manager On-Prem (SSM On-Prem). CVE-2024-20419 is an unverified password change weakness within the Cisco SSM On-Prem allowing the attacker to change the password of accounts without prior knowledge of the existing password.

There is currently no indication of exploits in-the-wild at the time of this post but exploit code is publicly available heightening the urgency to mitigate. Cisco updated their advisory on July 20, 2024 to reflect the availability of this exploit code.

For more information about the vulnerability, including the availability of patches and Tenable product coverage, please visit our blog.